|Alabama Code Title 13A: Criminal Code, Chapter 8: Offenses Involving Theft, Article 5: Alabama Digital Crime Act
|What Is Prohibited?
|Alabama prohibits multiple computer related crimes including:
- Computer Tampering – Knowingly doing any of the following without authority:
- Accessing, altering, damaging, or destroying any computer or computer system or network
- Altering, deleting, or destroying computer programs or data
- Disclosing, controlling, or taking computer programs, data, or supporting documentation
- Introducing a computer virus to a computer, system, or network
- Disrupting a computer, system, or network or denying computer access by any authorized user(s)
- Preventing a computer user from exiting a site or system to make the computer continue to connect or display contents of the site
- Getting confidential information or private records by accessing a computer, system, or network operated by Alabama or a local county, city, or medical institution
- Giving a computer user’s password, identification, debit card or bank account number, or other confidential computer security information to another person without his or her consent to restrict access to a computer, network, or data
- Encoded Data Fraud – Knowingly and with the intent to defraud a person possessing, using, or attempting to use a scanning device or re-encoder to access, get, or store encoded identification information from or place encoded information on a magnetic strip, integrated circuit, or radio frequency ID tag without permission of the authorized user of the item
- Phishing – Soliciting or taking any action on a website, in an email, or another way online to induce a person to provide identifying information by representing oneself as a business without that business’ authority
|What Is the Penalty?
|Penalties in Alabama are based on the felony or misdemeanor classification. Each class has its own sentencing ranges.
The standard penalty for computer tampering is a Class A misdemeanor. Class A misdemeanors can be penalized by not more than a year in jail and a $6,000 fine. However, the penalty is raised to a Class C felony when the crime’s done to defraud or harm anyone or get any benefit unlawfully. A Class C felony is punished by between 1 and 10 years in prison and up to a $15,000 fine.
The penalty also increases to a Class B felony when the damage caused is more than $2,500, the data sought is part of the Alabama Criminal Justice Information Center, or there’s an interruption of government operations, public communications, transportation, or water, gas, or other utility supply. Defendants convicted of Class B felonies can be sentenced to 2-10 years in prison and up to a $30,000 fine.
Finally, if the defendant causes physical injury to anyone during the crime or causes the victim to spend more than $100,000, then it’s a Class A felony. Class A felonies are subject to 10-99 years or life imprisonment and up to a $60,000 fine.
Both encoded data fraud and phishing are Class C felonies punished as stated above. Note that multiple violations from the same phishing act are considered one violation.
A defendant can be prosecuted for a computer crime and any other state laws they may have broken, such as assault in the case of the victim who’s physically injured during the crime.
A person who’s business, web page, trademark, or internet service or an individual that’s adversely affected by phishing can sue the defendant for their damages.
The Attorney General or District Attorney can request an injunction to permanently stop the website or other phishing device.
The prosecuting attorney can recover actual damages or $25,000, whatever is greater for each phishing violation. Also, if the defendant engaged in a pattern of phishing, the court can award not more than 3x the award to the person or business harmed. The proceeds of these civil fines will go to court costs, prosecution costs, as restitution to any victims, and finally the remainder will be shared equally between the State General Fund and Office of the Attorney General or District Attorney bringing the lawsuit.
If convicted of any of these crimes, the court will order any computer, system, or software used by the defendant be forfeited to the State and sold, destroyed, or disposed of. If the defendant is a minor, the property forfeited can belong to the parent or guardian. However, if the owner of the equipment didn’t authorize these illegal actions, this forfeiture doesn’t apply.
The court can award the property to any state, county, or city police department who participated in the investigation or prosecution. The police department can either use the computers or equipment or transfer them to another agency to support crime prevention. They can also sell the forfeited assets, first paying the costs of the sale. Then the court distributes the remaining proceeds to participating agencies for use in law enforcement.
Any scanning device or re-encoder owned by the defendant and used in violation of this law can be seized and destroyed as contraband by the investigating police department.
The court can order the defendant pay the costs of prosecution, investigation, and any other costs association with the crime.
|None of the Digital Act laws are intended to prevent law enforcement, state attorneys, the FBI, CIA, etc. from conducting lawfully authorized investigations and intelligence activities.
It’s also a defense to computer tampering that the actions taken were committed within the scope of one’s lawful employment, i.e. doing things reasonably necessary to perform your work assignment. Obviously, the janitor doesn’t need to log into the CEO’s computer, but the IT genius may need to figure out how to hack into an angry former employee’s old work laptop.